Download as PDF, PPTX
More Related Content
Similar to Advanced Threat Defense Intel Security
Advanced Threat Defense Intel Security
- 1. McAfee Advanced Threat Defense AhmedSharaf – Managing Director, Xband Enterprises, Inc. 2016
- 2. McAfee Confidential Threat Landscape 2 Source:McAfee Labs Q4 2015 New threats every minute, or more than 5 every second316 Daily attempts made to entice McAfee customers to connect to a risky URL157M More new mobile malware samples in Q472% Increase in new ransomware in Q426% Total ransomware samples in McAfee Labs Zoo6M New malware samples in Q4 – second highest on record42M Unique malware samples in the McAfee Labs Zoo as of Q4 2015476,000,000+
- 3. McAfee Confidential What IsAdvanced Malware? 3Source: Designing an Adaptive Security Architecture for Protection From Advanced Attacks (Published 12 February 2014) Evades Legacy-based Defenses Typically Criminal Discovered After the Fact Key Challenges • Existing blocking and prevention capabilities are insufficient to protect against motivated, advanced attackers. • Many of these attacks are not advanced in techniques; they are simply designed to bypass traditional signature- based mechanisms. Theft Sabotage Espionage Stealthy Targeted Unknown Data loss Costly clean-up Long-term damage
- 4. McAfee Confidential Advanced Malware 4 Marketwisdom IdentifiedUnknown However, Sandboxing by Itself Should Not be Your Only Defense Resource Intensive Not Real Time Lacks Scalability ? ? ? Because of Behavior AnalysisBecause No Signature Match ? ? ? Sandboxing Safe ? Malware ? Malware ? Alert vs Actions Not effective against all malware
- 5. McAfee Confidential Advanced ThreatDefense 5 Key differentiators Advanced Threat Defense Comprehensive Approach High-detection Accuracy Centralized Deployment
- 6. McAfee Confidential Comprehensive Approachto Malware 6 McAfee Threat Intelligence Exchange Enabled Endpoint McAfee ePO McAfee Network Security Platform McAfee Web Gateway McAfee Threat Intelligence Exchange/ Data Exchange Layer McAfee Advanced Threat Defense McAfee Enterprise Security Manager (SIEM) McAfee Active Response Protect DetectCorrect McAfee ePO McAfee Enterprise Security Manager (SIEM) McAfee Active Response McAfee Threat Intelligence Exchange/ Data Exchange Layer
- 7. McAfee Confidential Impacted systemsidentified in ATD reports New integration: McAfee Advanced Threat Defense and McAfee Active Response 7
- 8. McAfee Confidential Advanced ThreatDefense 8 Key differentiators Comprehensive Approach High-detection Accuracy Centralized Deployment Advanced Threat Defense
- 9. McAfee Confidential Dynamic and StaticCode Real-time Emulation Comprehensive Layered Approach Number of Samples You Can Process Known Good Known Bad File ExecutionEmulation White/ Black Listing AVGTI 9 Compute Cycles Needed/Time to Process
- 10. McAfee Confidential Dynamic andStatic Code Analysis 10 Analyze Static Code AnalysisDynamic Analysis Analyze Unpacking Disassembly of Code Calculate Latent Code Familial Resemblance Run Time DLLs Network Operations File Operations Process Operations Delayed Execution
- 11. McAfee Confidential Advanced ThreatDefense 11 Key differentiators Advanced Threat Defense Comprehensive Approach High-detection Accuracy Centralized Deployment
- 12. McAfee Confidential Numerous appliances Protocol-SpecificDeployment Firewall Data Center Servers End-user Endpoints DMZ DNS/App Web Gateway IPS Web Malware Analysis File Server Malware Analysis Internet 12 Endpoint Sandbox Manager Management and Forensics SIEM ePO Malware Analysis/ Forensics Central Manager
- 13. McAfee Confidential Lower costof ownership and scalability Firewall Data Center Servers End-user Endpoints DMZ Management and Forensics DNS/App Web Gateway IPS Malware Analysis/ Forensics Central Manager Web Malware Analysis File Server Malware Analysis Centralized Deployment Advanced Threat Defense Internet 13 SIEM ePO
- 14. McAfee Confidential Support foranalyst investigation Advanced capabilities • User interactive mode • Enables analysts to interact directly with malware samples • Extensive unpacking capabilities • Reduces investigation time from days to minutes • Full logic path • Enables deeper sample analysis by forcing execution of additional logic paths that remain dormant in typical sandbox environments • Sample submission to multiple virtual environments • Speeds investigation by determining which environment variables are needed for file execution. • Detailed reports provide critical information for analyst investigation • From disassembly output to graphical function call diagrams and embedded or dropped file 14
- 15. McAfee Confidential 15 Advanced Threat Defense BetterDetection, Better Protection. Lower Total Cost of Ownership. Faster Time to Malware Conviction, Containment, and Remediation.
- 17.
- 18. McAfee Confidential Advanced detectionfor stealthy, zero-day malware • Advanced analysis appliance • ATD-3000 • ATD-6000 • Deployment • Enhances security architecture – integrates with inline products • Stand alone research tool • History of innovation • Acquisition of ValidEdge sandbox technology: 2013 – Technology first released in 2004 – Used by primarily by security vendors and government agencies 18 McAfee Advanced Threat Defense
- 19. McAfee Confidential AV-TEST Results 19 SampleSize: Malicious Files • 7,616 Microsoft Office docs • 4,752 PDF docs • 131,871 Zoo malware • 12,132 Prevalent malware Sample Size: Clean Files • 96,722 clean files “The appliance showed great performance detecting 99.96% overall and no less than 99.5% in any single tested malware category. It also had a minimum of false positive detections at 0.01%.” 99.96% 96% 97% 98% 99% 100% Prevalent Malware Zoo Malware PDF Documents Microsoft Office Docs Overall Advanced Threat Defense Detection
- 20. McAfee Confidential Broad OSSupport • Target-specific analysis: Analyze threats under the exact conditions of the actual host profile within the organization • Reducing the chances of missed malware or false positives • Faster results: Scales sandboxing capacity • Customizable sandbox images • Broad support covers corporate environments, including server and mobile traffic 20 Windows 8 32/64 bit Windows 7 32/64 bit Windows XP 32/64bit Windows Server 2003-2008 Android Custom Image McAfee
- 21. McAfee Confidential The PackingChallenge • Custom packers used in targeted attacks • Packing or protecting changes the composition of the code or obfuscates it to evade detection and reverse engineering • Need to unpack to get to original executable code for analysis • Packed malware can hide • Delayed execution • Alternative execution paths 21 Source: McAfee Labs Q2 2014
- 22. McAfee Confidential Understand YourAdversary • Advanced Threat Defense immediately identifies the file as malicious with 14 specific classifications • Note, that static code analysis also shows the 43% of the code did not execute in the sandbox • So what else is missed if only dynamic analysis is used? 22
- 23. McAfee Confidential Static CodeAnalysis • Advanced Threat Defense unpacks and reverse engineers the file to expose the actual code for analysis • Compares code to known malicious code, identifying this relatively unknown file as part of the Trojan.Win32.simda malware family • Static code analysis finds 96% similarity to known malware family 23
- 24. McAfee Confidential Quarian –Designed for Sandbox Evasion 24 In Action 1. User receives phishing email 2. User Clicks link and downloads PDF 3. Other sandboxes see no bad behavior Malicious Web Server End User Attacker Phishing Email PDF download SANDBOX Quarian leverages older code but designed to identify a sandbox and stay silent Majority of code remains the same as previously known attack
- 25. McAfee Confidential ATD • AdvancedThreat Defense scans incoming PDF • Dynamic Analysis sees no bad behavior • Static Code Analysis unpacks and identifies code as known malicious Stopping Quarian and Sandbox Evasions 25 Advanced Threat Defense and Static Code Analysis ATD End User Analysis of Unpacked Code Malicious Web Server Attacker Phishing Email Family Name: Trojan.Win32.APT_Guodl Similarity Factor: 66.72
- 26. McAfee Confidential McAfee Global Threat Intelligence McAfee ATD McAfee VSEThreat Intelligence Module McAfee ePO McAfee Threat Intelligence Exchange 26 Adapt and immunize—from encounter to containment in milliseconds 3rd Party Feeds Data Exchange Layer McAfee TIE Server McAfee VSE Threat Intelligence Module NOYES Adaptive security improves anti-malware protection • Better analysis of the gray • Crowd-source reputations from your own environment • Manage risk tolerance across departments/system types Actionable intelligence • Early awareness of first occurrence flags attacks as they begin • Know who may be/was compromised when certificate or file reputation changes
- 27. McAfee Confidential McAfee ESM McAfee VSE Threat Intelligence Module McAfee VSEThreat Intelligence Module McAfee ePO McAfee ATD McAfee Web Gateway McAfee NSP McAfee Threat Intelligence Exchange 27 Instant protection across the enterprise Data Exchange Layer McAfee Global Threat Intelligence 3rd Party Feeds Gateways block access based on endpoint convictions Security components operate as one to immediately share relevant data between endpoint, gateway, and other security products Proactively and efficiently protect your organization as soon as a threat is revealed McAfee TIE Server
- 28. McAfee Confidential Adaptive ThreatPrevention and Detection 28 Web GatewayNIPS Network & Gateway Endpoints Sandbox SIEM IOC 1 IOC 2 IOC 3 IOC 4 network and endpoints adapt payload is analyzed new IOC intelligence pinpoints historic breaches previously breached systems are isolated and remediated DXL Ecosystem DXL Ecosystem